One possible way to sandbox the CGI code is to run it in it's own process or thread. Depending on that code's behavior, you might not have to destroy the thread/process after each request.

Another possibility is to let the webserver run it and have your Dancer app either send a redirect to the user's webbrowser, or send it's own HTTP request to the webserver. Obviously, if you go the redirect route, the CGI app wil have to be modified to include a redirect back to the Dancer app in it's response to the webbrowser's request.